Power Stroke LPE crashes with rectangles (rev >= 14226)

Bug #1473317 reported by jazzynico
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Inkscape
Fix Released
High
Krzysztof Kosinski

Bug Description

Reproduced on Windows XP (32 bit) and Xubuntu 15.04 (64 bit), Inkscape trunk rev. 14237.
Not reproduced with 0.91 and rev. 14212.
Likely a regression introduced with the 2geom update in r14226:
http://bazaar.launchpad.net/~inkscape.dev/inkscape/trunk/revision/14226

Steps:
1. Create a rectangle.
2. Apply a Power Stroke live path effect.
-> Crash with the following error:

Program received signal SIGSEGV, Segmentation fault.
0x0047bc08 in Geom::unitVector(Geom::D2<Geom::SBasis> const&, double, unsigned int) ()

Revision history for this message
jazzynico (jazzynico) wrote :
Changed in inkscape:
importance: Undecided → High
Revision history for this message
su_v (suv-lp) wrote :

On OS X 10.7.5, crash as described
- not reproduced with 0.91+devel r14224
- reproduced with 0.91+devel rev >= 14228

Note that the behavior of Powerstroke LPE applied to a rectangle was (kind of) undefined with r14224 already, producing "erratic" results and lots of warnings on the console:

** (inkscape-14224:3192): WARNING **: Exception during LPE Power stroke execution.
 lib2geom exception: assertion failed: B.isFinite() (../../src/2geom/sbasis-to-bezier.cpp:484)

Attached backtrace was produced with r14236 (debug build).

Changed in inkscape:
status: New → Triaged
summary: - Power Stroke LPE crashes with rectangles
+ Power Stroke LPE crashes with rectangles (rev >= 14226)
Revision history for this message
Alvin Penner (apenner) wrote :

possibly related to the use of 'H' and 'V' elements in the definition of paths for a rectangle.

attached is a demo file with two triangles. The top triangle allows the lpe powerstroke with no problem. The bottom triangle crashes with the lpe. The main difference is the top object contains only 'M' and 'L' in the path, while the bottom one has an 'H' for a horizontal line.

Revision history for this message
Alvin Penner (apenner) wrote :

please ignore the previous comment 3, it was ill-advised. The problem appears to be happening during the calculation of a derivative of an s-basis curve in the function LPEPowerStroke::doEffect_path, if the curve is a horizontal line. Attached is a demo file with two lines, one horizontal and one not.

Revision history for this message
Alvin Penner (apenner) wrote :

The output of the lpe was monitored using the attached diff file. For a normal, non-horizontal line, the output was as follows, with both the original line, and the derivative, and the start and end points, behaving normally.

doEffect pwd2_in = X: {46.1131, 120.952}s^0 Y: {120.107, 73.2381}s^0
doEffect derivative = X: {74.8393, 74.8393}s^0 Y: {-46.869, -46.869}s^0
doEffect at0() = (74.83928600000002, -46.869046)
doEffect at1() = (74.83928600000002, -46.869046)

For a horizontal line the output was abnormal. The Y version of the derivative is null, not just zero. The calls to at0() and at1() both fail, and Inkscape crashes. These calls, at0 and at1 are used downstream, for example in the function Geom::unitVector.

doEffect pwd2_in = X: {43, 145}s^0 Y: {151, 151}s^0
doEffect derivative = X: {102, 102}s^0 Y:

Revision history for this message
Alvin Penner (apenner) wrote :

attached is a proposed fix. This appears to fix the crash as far as I can tell. However it may have unintended side consequences that I don't know about, so it needs review.

Revision history for this message
Krzysztof Kosinski (tweenk) wrote :

For an SBasis containing only one Linear that has equal start and end points, the pop_back() that removes superfluous basis elements will remove that only Linear and cause at0() and at1() to be undefined, while what should actually happen is that the elements of the linear are both set to zero. This can be fixed by adding "&& k > 0" to the condition. Testing fix.

Changed in inkscape:
assignee: nobody → Krzysztof Kosinski (tweenk)
Revision history for this message
Krzysztof Kosinski (tweenk) wrote :

Should be fixed in r14248.

Changed in inkscape:
status: Triaged → Fix Released
milestone: 0.92 → none
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.